Cross‐layered distributed data‐driven framework for enhanced smart grid cyber‐physical security

Abstract

Smart Grid (SG) research and development has drawn much attention from academia, industry and government due to the great impact it will have on society, economics and the environment. Securing the SG is a considerably significant challenge due the increased dependency on communication networks to assist in physical process control, exposing them to various cyber-threats. In addition to attacks that change measurement values using False Data Injection (FDI) techniques, attacks on the communication network may disrupt the power system's real-time operation by intercepting messages, or by flooding the communication channels with unnecessary data. Addressing these attacks requires a cross-layer approach. In this paper a cross-layered strategy is presented, called Cross-Layer Ensemble CorrDet with Adaptive Statistics(CECD-AS), which integrates the detection of faulty SG measurement data as well as inconsistent network inter-arrival times and transmission delays for more reliable and accurate anomaly detection and attack interpretation. Numerical results show that CECD-AS can detect multiple False Data Injections, Denial of Service (DoS) and Man In The Middle (MITM) attacks with a high F1-score compared to current approaches that only use SG measurement data for detection such as the traditional physics-based State Estimation, ECD-AS strategy and other machine learning classification-based detection schemes.

Implementation Aspects of Smart Grids Cyber-Security Cross-Layered Framework for Critical Infrastructure Operation

“…In the following, the theoretical background of SE, ML, cyber-attack models, and communication networks performance metrics are presented. The equations utilized in this study are derived from our previous work [6].…”

“…The index numbers and timestamp values of data samples incoming from the communication layer and power grid layer are matched to synchronize and combine data as needed for the CECD-AS algorithm. The CECD-AS algorithm creates and updates statistical models for different regions of the SG using Woodbury Matrix Identities, anomaly scores using Mahalanobis distance measures, and updates adaptive thresholds for different regions based on the equations provided [4,6].…”

“…The detection results of MITM, FDI, DoS, and simultaneous FDI-DoS attacks through the use of the real-time CECD-AS algorithm are presented in Table 1 in terms of accuracy, precision, recall, and F1-score values. In the paper [6] where CECD-AS is presented, its cyber threat detection performance is shown to outperform the state-of-the-art physics-based and machine learning-based techniques. The results in this paper are based on the data and experiments discussed [6].…”

“…In the paper [6] where CECD-AS is presented, its cyber threat detection performance is shown to outperform the state-of-the-art physics-based and machine learning-based techniques. The results in this paper are based on the data and experiments discussed [6]. Table 1 shows that the real-time CECD-AS algorithm performs extremely well for a variety of cyber threats discussed in this paper.…”

“…Machine Learning (ML) technology is presently being utilized to aid in the detection process or to acquire reliable findings through statistical data analysis. At various phases of the SE process, the work of the data-driven anomaly detection framework and the cross-layer viewpoint has progressed and been examined [2][3][4][5][6]. An integrated solution of a cyber-physical security framework based on a cross-layer approach that focuses on the detection of various cyber assaults is described in this study.…”